GDPR
Overview
AccelByte Gaming Services (AGS) Starter's GDPR service helps you ensure your game’s compliance with the General Data Protection Regulation (GDPR) of the EU as well as the California Consumer Privacy Act (CCPA) of the state of California in the United States. These laws dictate how you and your users can use and manage the user’s personal data. Below are two tables that list the rights guaranteed by these laws and to which AGS Starter's service each relates.
GDPR
| Individual Right | Related Service | Remarks |
|---|---|---|
| The Right to Restrict Processing | UAM | The Right to Restrict Processing allows users to prevent their personal data from being used. Compliance with this right is ensured by giving each player the option to deactivate their account at any time. |
| The Right to Rectification | UAM, Event Log | The Right to Rectification allows users to make changes to any personal data stored within the UAM Service. It also requires the platform to be able to inform players of any changes made to that data. We use the event log service and mailer service to inform players about those changes. |
| The Right to Erasure | GDPR | The GDPR service functions as an automated service that schedules deletion of user data across services when a user requests it. |
| The Right to Data Portability | GDPR | The GDPR service ensures that user data collected across services is readable and potentially usable by different external services. |
| The Right to Access | GDPR | The GDPR service functions as an automated service that schedules collection of user data across services when a user requests it. |
| Rights in Relation to Automated Decision Making and Profiling | Event Log, Telemetry, Analytics | Telemetry and Analytics are configurable to ensure that users can opt-in or opt-out of the data collection process performed by those services. |
CCPA
| Individual Right | Related Service | Remarks |
|---|---|---|
| Rights to Know | GDPR | The GDPR service functions as an automated service that schedules collection of user data across services when a user requests it. |
| Rights to Data Portability | GDPR | The GDPR service ensures that user data collected across services is readable and potentially usable by different external services. |
| Rights to Deletion | GDPR | The GDPR service functions as an automated service that schedules deletion of user data across services when a user requests it. |
| Rights to Opt-Out | N/A | AccelByte doesn’t sell consumer data, so we don’t support this by default. It is your responsibility to ensure adherence to this regulation. |
| Rights to Opt-In for Children’s Personal Information | N/A | AccelByte doesn’t sell consumer data, so we don’t support this by default. It is your responsibility to ensure adherence to this regulation. |
How It Works
The two most basic rights users have to their data are the right to access that data and the right to delete it. The sequence diagrams below show how these requests are handled by our services.
Right of Access
Users can request access to their personal data either through the user platform or manually. A personal data request should be processed within 28 days.
Personal Data Retrieval Process
The chart below shows the different statuses a personal data request may move through, and for how long the request can be processed before it expires or is removed from the queue.
Request Status
- Pending The request is waiting to be processed.
- In-progress The request process has started.
- Retrying If the request fails, it will be automatically retried. The request will be retried a maximum of three times by default.
- Failed The request will be marked as Failed if the third retry is not successful. Both the user and the admin will be notified of this failure so that they can re-submit the request either from the user portal or admin portal.
- Expired This status only occurs if there is a problem with the related services. If a request expires, the user or admin will have to make a new request.
- Removed Any remaining requests are automatically removed from the queue after 56 days to optimize the service.
Successful Personal Data Request
Canceled Personal Data Request
Failed Personal Data Request
Right to Erasure
Users can request their personal data be deleted either through the user platform or manually. The request should be processed within 28 days.
Personal Data Deletion Process
The chart below shows the different statuses a data deletion request may move through, and for how long the request can be processed before it fails.
Request Status
- Request This status indicates that the request has been made but the user’s access token has not yet been revoked.
- Pending This status indicates that the user’s access token has already been revoked. The deletion request can still be canceled until the expiry date of the request.
- In Progress After the request has expired, the scheduler will begin the deletion process for that user’s account.
- Failed If the deletion process fails, the admin will be notified via email. The admin can then re-request the account be deleted, which will change the request’s status back to Pending.
Successful Data Deletion By User
Canceled Data Deletion By User
Data Deletion by Admin on Behalf of User
Deletion Process After Request Expiration
Retry Process for Failed Request
Managing GDPR in the Admin Portal
Personal Data Retrieval
Game administrators can request a user’s account data, which can be used to troubleshoot problems that occur in the account system or to keep track of a user’s changes to their account.
In the Admin Portal, go to the Users Management menu and search for the user whose personal data you want to retrieve. Click View and you’ll be directed to the user’s account data page.
In the Details section of the Overview tab, click the Send Request button next to Personal Data Request.
The Personal Data Request form will appear. Confirm the request by clicking the Send Request button.
Once the request is sent, the approval process can take up to 28 days.
When the requested data is ready to be downloaded, the request’s status will change to Completed and a download button will appear. Click the corresponding download symbol to download the requested data.
